CVE-2019-16148
Description
Sakai through 12.6 is vulnerable to stored XSS via a chat user name, allowing arbitrary JavaScript execution.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Sakai through 12.6 is vulnerable to stored XSS via a chat user name, allowing arbitrary JavaScript execution.
Vulnerability
CVE-2019-16148 describes a stored cross-site scripting (XSS) vulnerability in the Sakai learning management system, affecting versions through 12.6. The root cause is that the chat tool fails to escape user names when rendering chat messages, allowing an attacker to inject arbitrary HTML or JavaScript into the page [1][2].
Exploitation
An authenticated user can set a chat user name containing malicious JavaScript. When other users view the chat, the injected script executes in their browsers. No additional privileges are required beyond the ability to participate in a chat session [1].
Impact
Successful exploitation enables an attacker to execute arbitrary JavaScript in the context of other users' sessions. This can lead to session hijacking, data theft, or unauthorized actions performed on behalf of the victim [1].
Mitigation
The vulnerability is fixed in Sakai 12.7 and later. The patch, implemented in pull request #6971, uses fn:escapeXml to properly escape user names in the chat JSP template [2]. Users are advised to upgrade to a patched version.
AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.sakaiproject:chat-baseMaven | <= 12.6 | — |
Affected products
2- Sakai/Sakaidescription
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3- github.com/advisories/GHSA-q8wc-9xvp-g3c3ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2019-16148ghsaADVISORY
- github.com/sakaiproject/sakai/pull/6971ghsax_refsource_MISCWEB
News mentions
0No linked articles in our index yet.